C programming on Linux

Vineet Joglekar | 5 Apr 2005 02:08

Re: Adding a field to ext2_dir_entry_2


Hi Andreas,

I have created another file system - copied everything from ext2, renaming it as some different file system
and doing some experiments on that.

Let me be more clear about what I am trying to do. In my masters project, I am encrypting inodes along with the
data part of the file. Keys of different users are different. In the same directory, if there are 2 files
stored by different users, their inodes will be encrypted with different keys. If user1 is doing "ls" on
that directory, the inode of the other file - which is encrypted by user2, will be decrypted by using
user1's key, resulting into garbage. To avoid this, I am trying to store the uid in the directry entry, so
that  I can match it with current->fsuid and skip decrypting the inode if the file doesn't belong to the
current user. (assuming user1 doesnt want to share that file and different users can store different
files under same directory.)

Thanks and regards,

Vineet

 --- On Mon 04/04, Andreas Dilger < adilger <at> clusterfs.com > wrote:

From: Andreas Dilger [mailto: adilger <at> clusterfs.com]

To: vintya <at> excite.com

     Cc: linux-kernel <at> vger.kernel.org, linux-c-programming <at> vger.kernel.org

Date: Mon, 4 Apr 2005 17:17:59 -0600

Subject: Re: Adding a field to ext2_dir_entry_2

(Continue reading)

headers

Christopher Li | 5 Apr 2005 00:10

Re: Adding a field to ext2_dir_entry_2

That design sounds bad.

Anyway, I guess the error you are getting might have some thing to do with
the "." and ".." entry. Your current directory need to in the same
format as well. That is the price you pay for breaking the compatibility.

Chris

On Mon, Apr 04, 2005 at 08:08:57PM -0400, Vineet Joglekar wrote:
> 
> Hi Andreas,
> 
> I have created another file system - copied everything from ext2, renaming it as some different file
system and doing some experiments on that.
> 
> Let me be more clear about what I am trying to do. In my masters project, I am encrypting inodes along with the
data part of the file. Keys of different users are different. In the same directory, if there are 2 files
stored by different users, their inodes will be encrypted with different keys. If user1 is doing "ls" on
that directory, the inode of the other file - which is encrypted by user2, will be decrypted by using
user1's key, resulting into garbage. To avoid this, I am trying to store the uid in the directry entry, so
that  I can match it with current->fsuid and skip decrypting the inode if the file doesn't belong to the
current user. (assuming user1 doesnt want to share that file and different users can store different
files under same directory.)
> 
> Thanks and regards,
> 
> Vineet
> 
>  --- On Mon 04/04, Andreas Dilger < adilger <at> clusterfs.com > wrote:
> From: Andreas Dilger [mailto: adilger <at> clusterfs.com]

(Continue reading)

headers

Andreas Dilger | 5 Apr 2005 03:12

Re: Adding a field to ext2_dir_entry_2

On Apr 04, 2005  20:08 -0400, Vineet Joglekar wrote:
> I have created another file system - copied everything from ext2,
> renaming it as some different file system and doing some experiments on that.
> 
> Let me be more clear about what I am trying to do. In my masters
> project, I am encrypting inodes along with the data part of the file. Keys
> of different users are different. In the same directory, if there are
> 2 files stored by different users, their inodes will be encrypted with
> different keys. If user1 is doing "ls" on that directory, the inode
> of the other file - which is encrypted by user2, will be decrypted by
> using user1's key, resulting into garbage. To avoid this, I am trying
> to store the uid in the directry entry, so that  I can match it with
> current->fsuid and skip decrypting the inode if the file doesn't belong
> to the current user. (assuming user1 doesnt want to share that file and
> different users can store different files under same directory.)

This is broken by design.  What happens if you chown a file?  The UID will
change in the inode, but nothing will be updated in the directory.  This
key must be stored in the inode along with the ownership info (it can be
an EA, and possibly a fast EA or fixed inode field in a large inode).

Cheers, Andreas
--
Andreas Dilger
Principal Software Engineer
Cluster File Systems, Inc.

headers

Theodore Ts'o | 5 Apr 2005 05:53

Re: Adding a field to ext2_dir_entry_2

On Mon, Apr 04, 2005 at 07:12:51PM -0600, Andreas Dilger wrote:
> > Let me be more clear about what I am trying to do. In my masters
> > project, I am encrypting inodes along with the data part of the file. Keys
> > of different users are different. In the same directory, if there are
> > 2 files stored by different users, their inodes will be encrypted with
> > different keys. If user1 is doing "ls" on that directory, the inode
> > of the other file - which is encrypted by user2, will be decrypted by
> > using user1's key, resulting into garbage. To avoid this, I am trying
> > to store the uid in the directry entry, so that  I can match it with
> > current->fsuid and skip decrypting the inode if the file doesn't belong
> > to the current user. (assuming user1 doesnt want to share that file and
> > different users can store different files under same directory.)
> 
> This is broken by design.  What happens if you chown a file?  The UID will
> change in the inode, but nothing will be updated in the directory.  This
> key must be stored in the inode along with the ownership info (it can be
> an EA, and possibly a fast EA or fixed inode field in a large inode).

What else is broken about this design.  Let me count the ways...

1)  What about group access to files?

2)  It means that you can't do a filesystem consistency check without
knowing all of the keys, since the block pointers in the inode would
also be encrypted.

3) If user1 has previously accessed the file, the encrypted inode
information will already be cached, and visible when user2 accesses
the file; stat() doesn't result in a call into filesystem code if the
information is already cached.

(Continue reading)